Privacy & Cookies

Who is responsible for your information?

Kovuno Limited, trading as Kovuno, is the controller of personal information used to operate this website, manage enquiries and administer workspace access.

Address: Garden House, Bank Street, Bishop’s Waltham, UK SO32 1AN.
Email: hello@kovuno.co.uk.

Where we handle information solely on a customer’s instructions, our role and obligations are governed by the relevant agreement with that customer.

Information we handle

• Enquiries: your name, business contact details and information you include in correspondence.
• Workspace accounts: first name, last name, email address, company, account status and access permissions. These may be supplied by a Kovuno administrator or your organisation.
• Project records: company and property details, contracts, requests for proposals, drafting prompts, conversation history and document revisions. These may contain personal information about business contacts and other people named in a project.
• Electronic signatures: signer name, job title, business email, company details, agreement version and fingerprint, invitation/open/signing times, confirmation of authority and agreement, browser information and a one-way hash derived from the request IP address.
• Technical and security information: sign-in requests, session identifiers and request information such as IP addresses used to operate and protect the service. The application uses hashed IP addresses and email addresses for rate limiting.

Please share only information needed for the relevant enquiry or project. Do not include sensitive personal information in drafting prompts unless specifically agreed and necessary.

Why we use it and our legal bases

• To respond to enquiries and coordinate business relationships: our legitimate interests in communicating with prospective customers and partners. Where you personally are a party to a proposed contract, processing may also be necessary to take steps at your request before entering that contract.
• To manage accounts, documents and project work: our legitimate interests in providing services to the organisations we work with, or performance of a contract where that contract is with you personally.
• To authenticate users, control access and prevent misuse: our legitimate interests in maintaining a secure and reliable service.
• To meet applicable legal obligations and respond to lawful requests: compliance with legal obligations. Establishing or defending legal claims may also be based on our legitimate interests.

Where we rely on consent for an optional activity, we will explain that activity when requesting consent. You may withdraw that consent without affecting processing already carried out lawfully.

You can browse the public website without a workspace account. A registered email address is necessary to use email-link sign-in; without it we cannot provide workspace access.

AI-assisted document drafting

Our administrator can use OpenAI’s API to assist with drafting landlord contracts and requests for proposals. When this feature is used, the selected company name, current draft, prompt and recent conversation history are sent to OpenAI to produce a response.

Prompts, replies and document revisions are saved in the Kovuno workspace. API requests are configured not to store responses for later retrieval at OpenAI; this is not a promise that the provider retains no data for security or other service purposes.

Drafts require human review. This feature does not make solely automated decisions about individuals that produce legal or similarly significant effects. Drafting conversations and revision histories are restricted to the administrator. Customers can access documents explicitly shared with their company.

Who receives information?

Information is available to authorised Kovuno personnel and, where shared for a project, authorised contacts at the relevant customer organisation. Service providers support the website and workspace: OpenAI Sites and Cloudflare for hosting and storage, Twilio SendGrid for sign-in emails, and OpenAI for AI drafting. Our email service also processes correspondence sent to us.

Sign-in emails have click and open tracking disabled in our sending configuration. We may also disclose relevant information to professional advisers or authorities where necessary for legal obligations or claims. We do not sell personal information.

International processing

Our technology providers operate internationally, so personal information may be processed outside the UK. The applicable locations and transfer arrangements depend on the provider and service. UK data protection law requires an appropriate transfer mechanism where a restricted international transfer takes place, such as adequacy regulations or approved contractual safeguards. Contact us for information about the arrangements relevant to your data and how to obtain details of applicable safeguards.

How long information is kept

Retention depends on the purpose of the record, the status of the business relationship or project, applicable legal obligations and whether records are needed to resolve a dispute. Enquiry correspondence, account details and project documents are retained while needed for these purposes. You may contact us to ask about retention or request deletion of your information.

Magic sign-in links expire after 15 minutes and can be used once. Login sessions expire after eight hours. These expiry periods govern access; they do not mean all related database records are automatically deleted at that time. Disabling an account revokes its active sessions and sign-in links but does not automatically erase its contact details or project records.

Cookies

The website application does not include advertising trackers or analytics scripts. Its homepage video is hosted directly, rather than embedded from a social video platform.

The workspace sets one essential authentication cookie, __Host-solara, after successful sign-in. The name is retained from an earlier brand. It contains a random session identifier, keeps you signed in and expires after eight hours or is cleared on sign-out. It is marked Secure, HttpOnly and SameSite=Lax.

This cookie is necessary to provide the sign-in service you request and does not require cookie consent. You can block or delete cookies through your browser, but doing so will prevent or end workspace sign-in. Hosting infrastructure may also use essential security technologies. If we introduce optional tracking, we will explain it and provide the choices required by law before using it.

Protecting information

The workspace uses HTTPS, single-use sign-in links, restricted administrator permissions and company-level document access controls. Login and signing tokens are stored as hashes, agreements are fingerprinted when sent, and API credentials are kept on the server. Signing links are private and time limited. No online service can guarantee absolute security. Keep sign-in and signing links private and tell us promptly if you suspect unauthorised access.

Your rights and complaints

Depending on the circumstances, you can ask to access, correct or erase your personal information, restrict its use or receive a portable copy. You can object to processing based on legitimate interests and withdraw consent where that is the basis of processing. These rights are subject to legal conditions and exemptions.

Contact hello@kovuno.co.uk to exercise your rights. We may need to verify your identity. We normally respond within one month; if a lawful extension is necessary, we will explain why.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to contact us first, although we welcome the opportunity to address your concern.

Changes to this policy

We will update this page when our practices change and revise the date above. Where required, we will bring material changes to your attention.